InfoSecBulletin Cybersecurity for mankind
The Federal Communications Commission voted to start a program for labeling wireless consumer Internet of Things products with strong cybersecurity. This means that products meeting these standards will have a “U.S Cyber Trust Mark” label, helping consumers make better choices and encouraging manufacturers to improve cybersecurity.
The Commission has adopted the rules and framework for the program. The program highlights are:
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
• The U.S. Cyber Trust Mark logo will initially appear on wireless consumer IoT products that meet the program’s cybersecurity standards.
• The logo will be accompanied by a QR code that consumers can scan for easy-tounderstand details about the security of the product, such as the support period for the product and whether software patches and security updates are automatic.
• The voluntary program will rely on public-private collaboration, with the FCC providing oversight and approved third-party label administrators managing activities such as evaluating product applications, authorizing use of the label, and consumer education.
• Compliance testing will be handled by accredited labs.
• Examples of eligible products may include home security cameras, voice-activated
shopping devices, internet-connected appliances, fitness trackers, garage door openers, and baby monitors.
The Commission is asking for public opinions on extra disclosure requirements. This includes whether the software or firmware for a product is made or used by a company in a country that raises national security concerns. It also includes whether customer data collected by the product will be sent to servers in such a country.
There are many IoT products that use wireless networks. They are made up of different devices and technologies, each with its own security challenges. The Commission proposed a cybersecurity labeling program for IoT last August, and the rules adopted today are based on that proposal.
According to one third party estimate, there were more than 1.5 billion attacks against IoT devices in the first six months of 2021 alone. Others estimate that there will be more than 25 billion connected IoT devices in operation by 2030.
The cybersecurity labeling program is based on existing public and private efforts for IoT cybersecurity and labeling. It highlights the need for ongoing collaboration to help consumers use this technology with more confidence. The Commission approved the action on March 14, 2024.
